Session 8: Threat Actors, Attack Surfaces and Social Engineering | Talib Ali

Session type: Tutor-led learning
Topic: Threat actors and motivations, attack surfaces and attack vectors, and social engineering

Previous entry: Session 7: Security+ Session 1 — Security Concepts, Controls and Roles.

Session overview

This session continued the programme’s CompTIA Security+ preparation. It covered three main areas: threat actors and their motivations, attack surfaces and attack vectors, and social engineering. It was a concepts session, taught from slides and discussion, with real-world examples including Volt Typhoon and Stuxnet.

The tutor also showed a video about Stuxnet. There was no lab or practical exercise, and this entry makes no claim about specific exam objectives.

Taught and demonstrated

Each heading below records what the session covered, reconstructed from my notes. Where my notes attribute particular wording, an analogy or an example to the tutor, the entry says so. The beginner definitions, memory aids and worked examples were developed afterwards, while I wrote the session up. They appear only in boxes labelled Supplementary explanation, together with the accuracy qualifications, and are not the tutor’s words. Full explanations are in the Study Guide lessons linked at the end.

Threat actors and their categories

The session compared these threat actor categories: nation-state, organised crime (cybercriminal), hacktivist, insider, unskilled attacker and competitor.
The tutor also listed Shadow IT with the threat actors.
The tutor compared an unskilled attacker to a shoplifter: relatively opportunistic and often reliant on other people’s tools.
The tutor compared a sophisticated organised group to a coordinated heist team, such as the one in the film Ocean’s Eight.

Shadow IT is not a threat actor in the strict sense: it is unauthorised or unmanaged technology, usually adopted by staff trying to get their work done, and is better treated as an organisational risk. The Security+ SY0-701 objectives do list it with threat actors, so the grouping will be met again.

Threat actor attributes

The attributes covered were: source (internal or external), sophistication and capability, resources and funding, threat knowledge, and adversary behaviour.
In this session, threat knowledge meant the defender’s understanding of threats, not the attacker’s knowledge.

Threat knowledge is what defenders know about threats, such as known actors, tactics and techniques, vulnerabilities and indicators of compromise; adversary behaviour is what attackers actually do and how they operate.

Intent, objectives and motivations

Intent was covered under three descriptions: maliciously targeted, opportunistic, and accidental or unintentional.
Strategic objectives covered included service disruption, data exfiltration, disinformation, espionage and strategic advantage.
Underlying drivers covered included financial gain, fraud, extortion, blackmail, ideology, political objectives, revenge and competitive advantage.
The exact wording and grouping on the slides is not recorded.

Targeted or opportunistic describes how deliberately the victim was selected, while malicious or accidental describes intent, so an opportunistic attack can still be malicious. Nation-state is an actor type and not itself a motivation, and a whistleblower is not automatically a malicious threat actor.

Nation-state actors and advanced persistent threats

The session covered nation-state actors: state sponsorship, high capability, substantial resources, links to intelligence services in some cases, espionage, strategic advantage, disruption, influence and deniability.
The tutor described nation-state actors as having an “unlimited budget”.
The session covered advanced persistent threats (APTs) and intrusions carried out in several stages.

Nation-state actors may be extremely well resourced, but not literally unlimited in resources. Nation-state describes who the actor is or who sponsors it, while APT describes a sophisticated, persistent style of threat or campaign: they often overlap but are not synonyms.

Volt Typhoon and living off the land

The tutor used Volt Typhoon as a real-world example.
The session covered living off the land (LOTL): attackers using tools already present in the victim’s environment.
The tutor said Volt Typhoon had remained hidden for around five years.

The published basis for that figure is a February 2024 advisory from the US Cybersecurity and Infrastructure Security Agency and partner agencies, which reported indications of access to some victim IT environments for at least five years. It is an assessment about some environments, not a fixed fact about every intrusion by the group.

MITRE ATT&CK

The session covered MITRE ATT&CK as a resource on adversary tactics and techniques.
Whether the site was browsed during the session, and which pages were shown, is not recorded.

ATT&CK stands for Adversarial Tactics, Techniques, and Common Knowledge. A tactic is the adversary’s goal (the why), a technique is how the goal is achieved, and a sub-technique is a more specific form of a technique.

Organised crime and competitors

The session covered organised crime, driven by financial gain through fraud, ransomware, extortion, credential theft and stolen-data markets.
The session covered competitors, who seek commercial advantage, with intellectual property, trade secrets, research, product plans, pricing and strategic information as possible targets.

Insider threats

The session covered malicious insiders and unintentional insiders.
The tutor used a scenario in which an employee downloads technical files before moving to a competitor.

Insider describes the origin and access relationship, while malicious or unintentional describes intent; in the scenario the direct actor is the insider, and neither “malicious” nor “opportunistic” is a threat actor type. A contractor with trusted, authorised access can present insider risk, and working from home does not by itself make a risk external.

Vulnerability, threat and risk

The session related vulnerabilities, threats and risk to one another, and risk to impact and likelihood.

A threat exploiting a vulnerability creates risk; the level of that risk is then judged from likelihood and impact. These are two separate statements and should not be run together into one formula.

Leadership and security culture

The tutor used the analogy “Sick head = sick body” for the effect of leadership on an organisation’s security.

Cybersecurity culture often reflects leadership priorities: weak governance and poor leadership support can increase cyber risk across the organisation, through inadequate resourcing, weak policies, poor training, ignored risk and inconsistent enforcement.

Attack surfaces and attack vectors

The session covered the attack surface and attack vectors.
The tutor used a fictional water and power company and asked how an attacker could get in.

The attack surface is the total set of points where an attacker could interact with or try to compromise an organisation, system or application; an attack vector is the route or method actually used. The surface is relative to what is being assessed.

Vulnerable software and vulnerability scanning

Vulnerable software vectors covered were: faults in code, faults in design, delayed patching, difficult patching, unsupported systems, unsupported applications and legacy systems.
The session covered compensating controls for unsupported and legacy systems.
The session compared two ways of deploying vulnerability scanning. The session material called them client-based and agentless.

The usual industry term for scanning with software installed on the endpoint is agent-based; “client-based” is the wording the Security+ SY0-701 objectives use. An agent is a small background component, which is not the same as a thick client, a full locally installed application.

Network vectors

Network vectors covered were: local or direct access, remote access, wireless, cloud, unsecured networks, default credentials, open service ports, exposed network services and remote-management interfaces.

A vector is a route, and a weakness is what makes the route exploitable: remote access is a route, while default credentials are a weakness on it.

Stuxnet

The tutor showed a video about Stuxnet, as an example of a sophisticated attack against industrial systems.
Which video was shown is not recorded.

Message-based vectors

Message-based vectors covered were: email, SMS, instant messaging, web and social media, and voice calls.

Supply-chain attack surface

The session covered the supply chain as an attack surface: complexity and reach, third-party dependencies, procurement vulnerabilities, supplier access, managed service providers, software vendors, dependencies and libraries, and remote-support relationships.
My notes record the phrase “denying opportunity” in this part of the session.

A supply-chain attack reaches the target through a trusted supplier, vendor or dependency. Not every third-party incident is one: it becomes a supply-chain attack when that trusted relationship is abused as the route into the target.

The session covered social engineering as exploiting trust and human psychology.

Impersonation and pretexting

The session covered impersonation and pretexting.

Impersonation is who the attacker pretends to be; pretexting is the believable story or scenario used to justify the request.

The techniques covered were: phishing, spear phishing, smishing, vishing, pharming, typosquatting, watering-hole attacks and angler phishing.

Pharming redirects users to a fraudulent destination, and DNS manipulation is its classic example, not its only form.

Email spoofing and business email compromise

The session covered email spoofing and business email compromise (BEC).
Whether the email-authentication controls SPF, DKIM and DMARC were taught is not recorded; the Study Guide explains them as supplementary material.

Supplementary behavioural resources

The tutor showed or mentioned Chase Hughes, including the Neuro-Cognitive Intelligence (NCI) material and The Ellipsis Manual.
The tutor mentioned Chris Voss in relation to negotiation, rapport, persuasion, communication and podcasts.

These are supplementary behavioural and influence resources, not Security+ frameworks or exam authorities. Legitimate negotiation techniques are not inherently malicious: they become a cybersecurity concern when used deceptively to obtain access, data or compliance.

Practical activity and evidence

Demonstrated by the tutor: a video about Stuxnet was shown. Watching it was observation, not practical work.
Completed by me: no practical work. There was no lab, configuration, scanning or testing in this session.
Discussed but not performed: how an attacker could get into the fictional water and power company; vulnerability scanning approaches, with no scan run; and MITRE ATT&CK, with no incident mapped to it.
Not recorded: the exact wording of the slides; which Stuxnet video was shown; which MITRE ATT&CK pages, if any, were shown; whether email authentication was taught; and whether any review questions were set.

Key takeaways

Four questions keep the vocabulary apart: who is the threat actor, why is the motivation, how is the attack vector and where is the attack surface.
A vulnerability is a weakness, a threat is a potential danger, and risk is the potential harm when one meets the other. Likelihood and impact decide how large the risk is.
Nation-state says who; APT says how the threat operates. They often overlap and are not synonyms.
Internal or external is about source; malicious or unintentional is about intent; targeted or opportunistic is about how the victim was chosen.
Phishing tricks the person, pharming redirects the traffic, and a watering-hole attack waits where the target already goes.

Threat Actor Types, Attributes and Motivations: the four questions, vulnerability, threat and risk, the actor types, Shadow IT, attributes, intent and motivation, insider threats and security culture.
Nation-State Actors, APTs and MITRE ATT&CK: nation-state actors and deniability, advanced persistent threats, living off the land, Volt Typhoon, and tactics and techniques.
Attack Surfaces and Attack Vectors: surface and vector, the water and power company, software, network, message-based and supply-chain vectors, agent-based and agentless scanning, Stuxnet and reducing the attack surface.
Social Engineering and Phishing: psychological triggers, impersonation and pretexting, the phishing family, pharming, typosquatting, watering-hole attacks, SPF, DKIM and DMARC and business email compromise.

How this entry was put together

Sources: my notes from the session, which was taught from the tutor’s slides and verbal explanation.
Wording: the points under Taught and demonstrated say what the session covered. They are recorded in my own words, not copied from the slides. The only words quoted from the tutor are “unlimited budget” and “Sick head = sick body”; the phrase “denying opportunity” is quoted from my notes.
Supplementary explanation: everything in the boxes labelled Supplementary explanation is mine and is not attributed to the tutor. The beginner definitions, the professional wording of the leadership point and every accuracy qualification were developed afterwards, while I wrote up my notes.
Independently checked: the Volt Typhoon figure against the published CISA advisory, and the Security+ wording against the published SY0-701 objectives. These are external references, not course evidence.
Not recorded: the exact wording of the slides, which Stuxnet video was shown, which MITRE ATT&CK pages were shown, whether email authentication was taught and whether review questions were set.
Reflection: not yet written. I will add my own reflection on this session; none has been generated for this entry.
Diagrams: none in this entry. The linked lessons contain original diagrams; none reproduces the tutor’s slides.
No practical work: this entry records classroom teaching and an observed video. It is not evidence of a lab, a scan, a threat assessment or any work on a real organisation, and it does not record a qualification.

Next entry: Session 9: Cryptographic Algorithms, Public Key Infrastructure and Cryptographic Solutions.